CVE-2026-63755
Received Received - Intake

SurrealDB Authentication Bypass via WHERE Clause Evaluation

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63755
EUVD
EUVD-2026-45926

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.1.0 has a flaw where user-supplied WHERE clauses in SELECT statements are evaluated against full record data before permission checks are enforced. This allows authenticated users, including those with Record or Scope access, to bypass table-level permission restrictions and read the full contents of any table in their current database.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.1.0. Run: surreal version. If the version is older, the system is vulnerable. Additionally, review database logs for unusual SELECT queries with WHERE clauses accessing full records.

Impact Analysis

An attacker with authenticated access could exploit this to read sensitive data from any table in the database they are connected to. This includes data they should not have permission to access. Exfiltration can occur through scripting functions, THROW statements, or timing-based side channels even without scripting enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR and HIPAA compliance requirements for data protection and access controls. Organizations using affected SurrealDB versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later immediately. Disable scripting functions if enabled (--allow-scripting). Restrict query access to trusted users and rely on namespace/database isolation instead of table-level permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart